启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Publisher]
    <StormCodec_Helper><"d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
    <AVPSrv><C:\WINDOWS\AVPSrv.exE>  []
    <DbgHlp32><C:\WINDOWS\DbgHlp32.exe>  []
    <cmdbcs><C:\WINDOWS\cmdbcs.exe>  []
    <upxdnd><C:\WINDOWS\upxdnd.exe>  []
    <NVDispDrv><C:\WINDOWS\NVDispDRV.EXE>  []
    <msccrt><C:\WINDOWS\msccrt.exe>  []
    <WinSysM><C:\WINDOWS\273100M.exe>  [N/A]
    <MsIMMs32><C:\WINDOWS\MsIMMs32.exE>  []
    <mppds><C:\WINDOWS\mppds.exe>  []
    <PTSShell><C:\WINDOWS\PTSShell.exe>  []
    <LotusHlp><C:\WINDOWS\LotusHlp.exe>  []
    <MsPrint32D><C:\WINDOWS\MsPrint32D.exe>  []
    <Kvsc3><C:\WINDOWS\Kvsc3.exE>  []
    <WinSysW><C:\WINDOWS\273100L.exe>  [N/A]
    <SSLDyn><C:\WINDOWS\SSLDyn.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <MSDEG32><LYLoader.exe>  []
    <MSDWG32><LYLoadbr.exe>  [N/A]
    <MSDCG32    ><LYLeador.exe>  [N/A]
    <MSDOG32><LYLoador.exe>  [N/A]
    <MSDSG32><LYLoadar.exe>  [N/A]
    <MSDMG32><LYLoadmr.exe>  []
    <MSDHG32><LYLoadhr.exe>  [N/A]
    <MSDQG32><LYLoadqr.exe>  [N/A]
    <n6819><rundll32 "C:\WINDOWS\Downlo~1\n6819.dll",Run>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]
    <WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll>  [System Safety Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]

==================================
启动文件夹
N/A

==================================
服务
[DCOM Server Process Launcher / DcomLaunch][Running/Auto Start]
  <C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
[F726DD7E / F726DD7E][Stopped/Auto Start]
  <C:\WINDOWS\system32\C5A5AF4E.EXE -k><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[ms_2fax / ms_2fax][Running/Auto Start]
  <C:\WINDOWS\system32\b0d41.exe><Microsoft Corporation>
[Remote Procedure Call (RPC) / RpcSs][Running/Auto Start]
  <C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><>
[svchost / svchost][Stopped/Auto Start]
  <C:\WINDOWS\system32\dllcache\svchost.exe -g><Microsoft Corporation>
[Terminal Services / TermService][Running/Manual Start]
  <C:\WINDOWS\System32\svchost -k DComLaunch-->%SystemRoot%\System32\termsrv.dll><Microsoft Corporation>

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

驱动程序
[acpidisk / acpidisk][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[kqjkha2 / kqjkha27][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\kqjkha27.sys><N/A>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[System Safety Monitor 2.0 Core Engine / safemon][Running/Boot Start]
  <\SystemRoot\system32\drivers\safemon.sys><System Safety Limited>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>

==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\xunlei\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Info cache]
  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
[Thunder Browser Helper]
  {5FB8C5D3-929F-4870-89E2-7E3EE26EE701} <D:\xunlei\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[Invoke Class]
  {5FB8C5D4-929F-4870-89E2-7E3EE26EE701} <C:\WINDOWS\system32\2b01.dll, >
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\xunlei\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Info cache]
  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <D:\xunlei\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Invoke Class]
  {5FB8C5D4-929F-4870-89E2-7E3EE26EE701} <C:\WINDOWS\system32\2b01.dll, >
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\xunlei\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[使用迅雷下载]
  <D:\xunlei\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <D:\xunlei\Program\getallurl.htm, N/A>

正在运行的进程
[PID: 448 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 504 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 528 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\SSMWinlogonEx.dll]  [System Safety Limited, 2.1.0.575]
    [C:\WINDOWS\system32\winlib .dll]  [N/A, ]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
    [C:\WINDOWS\system32\svchost.dll]  [Microsoft Corporation, ]
[PID: 572 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\LYMANGR.DLL]  [N/A, ]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 584 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 736 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 800 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 864 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 908 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 1016 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 1272 / xiehong][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\kqjkha27.dll]  [N/A, ]
    [C:\WINDOWS\system32\SHQMANGR.DLL]  [N/A, ]
    [C:\WINDOWS\Downlo~1\n6819.dll]  [Microsoft Corporation, 5, 3, 2600, 2180]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
    [C:\WINDOWS\system32\svchost.dll]  [Microsoft Corporation, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\273100MM.DLL]  [N/A, ]
    [C:\WINDOWS\273100WL.DLL]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\Kvsc3.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [D:\xunlei\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.15]
    [C:\WINDOWS\system32\2b01.dll]  [, 1, 0, 0, 2]
    [D:\xunlei\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 18]
    [D:\xunlei\Components\ResWorker\DsBho_01.dll]  [, 1, 0, 0, 11]
    [D:\xunlei\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
    [d:\Program Files\WinRAR\rarext.dll]  [N/A, ]
[PID: 1304 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
[PID: 1504 / xiehong][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5, 1, 0, 56]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
[PID: 1640 / xiehong][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\1A15B6DC.DLL]  [, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
[PID: 1740 / xiehong][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
[PID: 2120 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2424 / xiehong][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\021.dll]  [  , 1, 0, 0, 3]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
[PID: 2964 / SYSTEM][C:\WINDOWS\system32\b0d41.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2984 / xiehong][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\xunlei\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.15]
    [C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll]  [金泰丰(广州)科技有限公司, 2, 3, 0, 0]
    [C:\WINDOWS\system32\2b01.dll]  [, 1, 0, 0, 2]
    [D:\xunlei\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 18]
    [D:\xunlei\Components\ResWorker\DsBho_01.dll]  [, 1, 0, 0, 11]
    [D:\xunlei\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\Kvsc3.dll]  [N/A, ]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 2308 / xiehong][D:\xunlei\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5.7.2.371]
    [D:\xunlei\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 2, 2, 33]
    [D:\xunlei\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 18, 2, 151]
    [D:\xunlei\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [D:\xunlei\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 18, 2, 151]
    [D:\xunlei\Program\streammedialib.dll]  [, 1, 1, 2, 55]
    [D:\xunlei\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
    [D:\xunlei\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 3, 21]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\Kvsc3.dll]  [N/A, ]

[D:\xunlei\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 33]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [D:\xunlei\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 9]
    [D:\xunlei\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 21]
    [D:\xunlei\Components\InMedia\iEmbed12.dll]  [Thunder Networking Technologies,LTD, 3, 4, 3, 93]
    [D:\xunlei\Components\InMedia\PlayerHelper.dll]  [thunder, 1, 1, 0, 24]
    [D:\xunlei\Components\InMedia\XLIPC.DLL]  [N/A, ]
    [D:\xunlei\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 4, 69]
    [D:\xunlei\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 3, 2, 8]
    [D:\xunlei\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 16, 5, 63]
    [D:\xunlei\Program\MSVCIRT.dll]  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\xunlei\Components\Security\ThunderSafe.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
    [D:\xunlei\Program\ATL71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [D:\xunlei\Components\Security\XLSafeUI.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
    [D:\xunlei\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 1, 5, 18]
    [D:\xunlei\Program\LiveUpdate.dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 20]
    [D:\xunlei\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
    [D:\xunlei\Plugins\XLSafeHost\XLSafeHost.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
    [D:\xunlei\Plugins\GouGouTop\GouGouTop.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 3]
    [D:\xunlei\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
    [D:\xunlei\ComDlls\ThunderAgent_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 4, 22]
    [D:\xunlei\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 18]
    [D:\xunlei\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.15]
    [D:\xunlei\Components\Tips\TipsClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 9, 97]
    [D:\xunlei\Components\VPSHELL\VPSHELL.dll]  [XunLei, 1, 3, 0, 18]
    [D:\xunlei\Components\VPSHELL\VideoPicture.dll]  [XunLei, 1, 3, 0, 18]
    [D:\xunlei\Components\UserExperience\UserExperience.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [D:\xunlei\Components\ResWorker\DsXlCom.dll]  [, 1, 0, 0, 23]
    [D:\xunlei\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
    [D:\xunlei\Components\ResWorker\MediaWorker.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 19]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [D:\xunlei\Components\DownloadStat\DownloadStat.dll]  [深圳市迅雷网络技术有限公司, 1, 1, 0, 1]
    [D:\xunlei\Components\Tips\XLIPC.DLL]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[PID: 2952 / xiehong][D:\xunlei\Components\InMedia\Minisite.exe]  [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
    [D:\xunlei\Components\InMedia\XLIPC.DLL]  [N/A, ]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 3256 / xiehong][d:\Program Files\WinRAR\WinRAR.exe]  [N/A, ]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\Kvsc3.dll]  [N/A, ]
[PID: 3280 / xiehong][C:\DOCUME~1\xiehong\LOCALS~1\Temp\Rar$EX00.031\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\ppmrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\fbkpdf.dll]  [N/A, ]
    [C:\WINDOWS\system32\avmtdw.dll]  [N/A, ]
    [C:\WINDOWS\system32\addbjj.dll]  [N/A, ]
    [C:\WINDOWS\system32\dcjdir.dll]  [N/A, ]
    [C:\WINDOWS\system32\hzculq.dll]  [N/A, ]
    [C:\WINDOWS\system32\sbjrhe.dll]  [N/A, ]
    [C:\WINDOWS\system32\lkqmfq.dll]  [N/A, ]
    [C:\WINDOWS\system32\uxuzoe.dll]  [N/A, ]
    [C:\WINDOWS\system32\qpvxym.dll]  [N/A, ]
    [C:\WINDOWS\system32\qkbrvc.dll]  [N/A, ]
    [C:\WINDOWS\system32\Kvsc3.dll]  [N/A, ]
    [C:\DOCUME~1\xiehong\LOCALS~1\Temp\Rar$EX00.031\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [C:\DOCUME~1\xiehong\LOCALS~1\Temp\Rar$EX00.031\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 2308, D:\XUNLEI\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2952, D:\XUNLEI\COMPONENTS\INMEDIA\MINISITE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3256, D:\PROGRAM FILES\WINRAR\WINRAR.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

本人给你的建议是把所有盘都格了。。然后重装。。

综合分析了目前收到的所有Auto.exe的病毒特征,采用自创的查杀分析引擎,对系统文件夹,各盘根目录,注册表项目,服务项目进行独一排查,一般感染此病毒后重启电脑一次就可以完全清除了.

点击开始查杀,进行检测为保证查杀效果,务必切断网络后运行 
http://download.it168.com/08/0803/81889/81889_3.shtml(下载地址）如不能打开网页请在带网络的安全模式下　　下载不行我发邮件给你

多谢大哥的指点!!!我先下下来看下!

等看结果，从日志进程中插入的模块来看，不一定能处理清。
C:\WINDOWS\system32\winlib .dll
C:\WINDOWS\system32\1A15B6DC.DLL
C:\WINDOWS\system32\LYMANGR.DLL